Configuring Checkov scans

Overview

Checkov is a static code analysis tool for infrastructure-as-code (IaC). It scans cloud configurations for security and compliance misconfigurations. It ensures:

  • Infrastructure-as-code is aligned with security best practices.
  • Scans for issues like open ports, hardcoded secrets, excessive privileges, and insecure configurations.
  • Works across cloud platforms and container orchestration systems, helping to avoid security risks in the deployment process.

This scan is part of the compliance checks stage available in the PR (app-preview), CI, and CC pipelines.

Enabling and configuring Checkov scans

You can run Checkov scans using the following frameworks:

  • Terraform Plan: Run Checkov scan on a computed Terraform plan. To enable this, add opt-in-checkov as a text property to your pipeline or trigger properties, with a value set to a non-empty string (except 0).
  • Kubernetes: Run Checkov scan on Kubernetes manifests. To enable this, add opt-in-checkov-kubernetes as a text property to your pipeline or trigger properties, with a value set to a non-empty string (except 0). Note: With Code Risk Analyzer (CRA) being deprecated, Checkov Kubernetes scan is an alternative for cra-deploy-analysis that produces com.ibm.code_cis_check evidences.
  • Helm: Run Checkov scan on Helm charts. To enable this, add opt-in-checkov-helm as a text property to your pipeline or trigger properties, with a value set to a non-empty string (except 0). Note: When both opt-in-checkov-kubernetes and opt-in-checkov-helm are enabled, a single Checkov invocation is run with both frameworks (--framework kubernetes,helm). Both produce com.ibm.code_cis_check evidence.
  • Dockerfile: Run Checkov scan on Dockerfiles. To enable this, add opt-in-checkov-dockerfile as a text property to your pipeline or trigger properties, with a value set to a non-empty string (except 0).

Enabling these features runs the run-checkov script from the compliance checks stage.

This script automatically install Checkov if it is not already present in the environment.

Checkov parameters

The pipeline environment properties and secrets listed in the following table are used to customize the Checkov scans.

Checkov parameters
Parameter name Description
opt-in-checkov Set to a non-empty string (except 0) to enable the Terraform Plan Checkov scan.
opt-in-checkov-kubernetes Set to a non-empty string (except 0) to enable the Kubernetes Checkov scan.
opt-in-checkov-helm Set to a non-empty string (except 0) to enable the Helm Checkov scan. Can be combined with opt-in-checkov-kubernetes for a single combined invocation.
opt-in-checkov-dockerfile Set to a non-empty string (except 0) to enable the Dockerfile Checkov scan.
checkov-args Additional arguments provided directly to the checkov command.
tf-dir Location or path in the source repository where main.tf is located. Applies to the Terraform Plan framework only. (Defaults to .)
checkov-version Checkov version to install if not already available in the environment. (Defaults to installing the latest version)
checkov-prisma-api-url The Prisma Cloud API URL. Must be a *.prismacloud.io, *.prismacloud.cn or *.bridgecrew.cloud domain.
checkov-bc-api-key Bridgecrew API key or Prisma Cloud Access Key. Retrieve this using get_secret.

Checkov evidence and attachments

The DevSecOps pipeline uploads evidence to the locker and includes the evidence in the evidence summary for Change Requests.

Checkov Terraform Plan Evidence

The following table lists the evidence details for the Terraform Plan checkov scan.

Checkov Terraform Plan evidence fields and values
Field Value
tool type checkov
evidence type com.ibm.code_vulnerability_scan
asset type repo
attachments Checkov results JSON file
Checkov Kubernetes Evidence

The following table lists the evidence details for the Kubernetes checkov scan.

Checkov Kubernetes evidence fields and values
Field Value
tool type checkov
evidence type com.ibm.code_cis_check
asset type repo
attachments Checkov results JSON file
Checkov Helm Evidence

The following table lists the evidence details for the Helm checkov scan.

Checkov Helm evidence fields and values
Field Value
tool type checkov
evidence type com.ibm.code_cis_check
asset type repo
attachments Checkov results JSON file
Checkov Dockerfile Evidence

The following table lists the evidence details for the Dockerfile checkov scan.

Checkov Dockerfile evidence fields and values
Field Value
tool type checkov
evidence type com.ibm.code_vulnerability_scan
asset type repo
attachments Checkov results JSON file

Accessing your scan results

You can access your scan results by using the following method: